The Neutral Network Layer: Security Control Independent of the Human, the Endpoint, the Vendor, and the Response Loop

This paper defines the neutral network layer: a class of security control specified by four independences (from the human at the moment of enforcement, from the endpoint, from the vendor access path, and from the alert-mediated response loop) together with a fifth constraint, neutrality toward production, without which no OT operator will enable enforcement. Each independence is stated with a falsifiable field test. The paper reviews the efficacy record of the controls these independences replace, including awareness training (UCSD Health RCT, SOUPS decay findings), boundary firewalls (misconfiguration and rule rot), passive detection (alert-to-enforcement latency), and vendor remote access, then scores six established market categories against the tests and maps four worked cases (Colonial Pipeline, Target, Maersk/NotPetya, Norsk Hydro) to the independence each lacked. A disclosed reference implementation section and a conflict of interest statement identify the author's commercial position.